Draft for review: Security notes for Pipeline authors #4667
+37
−0
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
probot-autolabeler
bot
added
the
documentation
Wadeck
requested changes
Nov 1, 2021
Co-authored-by: Wadeck Follonier <Wadeck@users.noreply.github.com>
Co-authored-by: Wadeck Follonier <Wadeck@users.noreply.github.com>
kwhetstone
reviewed
Nov 9, 2021
|
|
||
| == Use Credentials to Access Resources | ||
|
|
||
| If your Pipeline needs to access external resources such as a database, artifact repository, or cloud, be sure to use credentials [add link] for authorization rather than hard coding the username/password, secret text, or other identifiers in your Pipeline. |
There was a problem hiding this comment.
Is this link in the main document so it can't be updated yet?
There was a problem hiding this comment.
Link added in 22eb380
| and be very careful when passing sensitive data such as environment variables. | ||
| Never enclose sensitive environment variables in double quotes! | ||
| Data inside double quotes is subject to Groovy string interpolation, which means that Groovy evaluates the string and passes the actual value through where it may be visible as an argument to the `sh` or `bat` step or some other facility. | ||
| Data that is enclosed in single quotes is passed to the interpreter (`sh`, `bat`, `powershell`, or `pwsh` for evaluation and so is secure. |
There was a problem hiding this comment.
I don't know if you want to mention if that extends to the multi-line strings? ''' and """
There was a problem hiding this comment.
Sure, but could you give me a little more information? Maybe a code snippet as an example? I find one mention of multiline strings in "Storing Secrets" in /doc/developer but no discussion of them and I'm not familiar with them.
github-actions
bot
added
the
unresolved-merge-conflict
|
Please take a moment and address the merge conflicts of your pull request. Thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a draft to work on content. After #4612 is merged, this PR should be integrated into _chapter.yml appropriately and be mentioned in the index.doc and managing-security.adoc files.
@daniel-beck @Wadeck I made a rough start on the content and provided the relevant xrefs but I don't think that my prose is the best and there are probably other issues that should be included here.